ISO 22301 LI common mistakes
ISO 22301 LI · Understand the traps and how to avoid them.
Treating ISO 22301 as a prescriptive checklist of required documents and controls, so when asked what the standard requires the candidate lists templates (a BIA template, a risk register, a plan) rather than the clause-level requirements to establish, implement, maintain and continually improve a BCMS.
Many candidates come from ISO 27001 or from template-driven implementation projects where the deliverable is the artefact; they memorise document names instead of the management-system logic (context, leadership, planning, support, operation, performance evaluation, improvement).
What to do instead
Rehearse the standard as a Plan-Do-Check-Act management system: for each clause be able to state the requirement in one sentence and the evidence that would demonstrate conformity. When a question asks 'what does ISO 22301 require', answer with the requirement and only then give the artefact as evidence.
Confusing business continuity management with emergency response or IT disaster recovery, answering questions about scope, BIA and strategy selection with answers about evacuation plans, crisis communications or backup data centres.
Emergency response and DR are the most visible parts of continuity work, so candidates anchor on them; the standard's broader scope (all disruptive incidents, all products and services, the whole management system) is less familiar.
What to do instead
Before answering, classify the question: is it about the management system, about business impact and risk assessment, about continuity strategies and solutions, or about incident response structure? Emergency response and IT DR are subsets of the last two and never the whole answer.
Starting the implementation answer with the BIA, risk assessment or plan writing, skipping the activities that must come first: understanding the organisation and its context, obtaining top management commitment, defining the BCMS scope and boundaries, and producing a high-level scope statement.
Candidates equate 'starting a BCMS' with 'doing the technical continuity work', and the early clauses feel like paperwork that can be done later; exam questions often probe the correct sequence.
What to do instead
Memorise the initiation sequence: context and interested parties, leadership commitment and BCMS policy, roles and responsibilities, scope and boundaries, then objectives and plans to achieve them. BIA and risk assessment come later, in planning, and must be traceable to the scope.
Defining the BCMS scope purely by organisational unit or location, or copying the IT department's scope, without considering products, services, interfaces and dependencies, and without documenting justification for exclusions.
Scope is often inherited from an existing ISO 27001 certificate or drawn on an org chart; candidates underestimate how scope decisions constrain the BIA, strategies and the audit.
What to do instead
State scope in terms of products and services plus the supporting activities, sites, dependencies and interfaces that deliver them; require documented justification for anything excluded and check that the scope is consistent with the BCMS policy and objectives.
Treating the business impact analysis and the risk assessment as interchangeable, or producing a BIA that lists only recovery time objectives without analysing impacts over time, minimum acceptable service levels and dependencies.
Both are 'assessments' feeding strategy selection, and candidates often learn only the RTO vocabulary; the distinct purpose of the BIA (prioritisation and continuity requirements) versus risk assessment (likelihood and consequence of disruption, and controls) blurs.
What to do instead
Be able to state the BIA outputs (prioritised activities and products/services, impact tolerances over time, minimum resource requirements, dependencies) and the risk assessment outputs (prioritised risks with likelihood, impact and treatment). Practise explaining how each output feeds strategy selection differently.
Selecting continuity strategies and solutions by choosing a single recovery site or technology, without demonstrating that the chosen option meets the BIA-derived requirements and without evaluating the associated risks and costs.
Candidates default to familiar technical solutions (hot site, cloud failover) and forget that strategies must cover people, information, facilities, suppliers and partners, and must be justified against the impact tolerances.
What to do instead
For each prioritised activity, show the requirement from the BIA, list candidate strategies across all resource categories, evaluate feasibility, cost and residual risk, and document the rationale for the selected solution and any accepted residual risk.
Writing business continuity plans and incident response structures that name roles but not decision authority, escalation triggers and thresholds, or that assume a single 'crisis team' will handle everything regardless of incident type and severity.
Plan templates emphasise role titles and contact lists; candidates reproduce them without thinking about how and when the structure activates and who decides to invoke it.
What to do instead
For every plan, be able to describe activation criteria and thresholds, the decision authority to invoke and escalate, the incident response structure with clear roles and deputies, internal and external communication arrangements, and how plans link to each other and to suppliers.
Confusing exercise and testing with awareness and training, or describing exercises only as 'we test the plan annually' without specifying objectives, scope, scenarios, participants and how findings are captured and acted on.
Both sit under competence, awareness and communication or under exercising and testing, and candidates compress them into a generic 'we train and test' answer that does not demonstrate understanding of the distinct requirements.
What to do instead
Separate the concepts: competence and awareness build capability in people; exercising and testing validate plans, strategies and arrangements against defined objectives. Always include objective, scope, scenario, participants, evaluation and the route from findings to corrective action.
Describing monitoring, measurement, analysis and evaluation as 'we do internal audits and management review', omitting the definition of what is monitored, the methods, criteria and when results are analysed and evaluated, and how KPIs link to continuity objectives.
Candidates collapse performance evaluation into the two most familiar activities and forget that monitoring and measurement is a separate requirement with its own planning content.
What to do instead
State the monitoring programme explicitly: what is monitored (objectives, plan effectiveness, exercise results, supplier performance, incident trends), the methods and metrics, frequency and responsibility, and how analysis feeds management review and improvement.
Handling nonconformities and corrective actions by fixing the immediate symptom only, without recording the nonconformity, determining its cause, evaluating the need for action to eliminate the cause, and reviewing the effectiveness of action taken.
In practice many organisations close findings by patching the document; candidates mirror that habit and skip root-cause analysis and effectiveness review, which are exactly what the standard requires.
What to do instead
Use the full sequence for every nonconformity: react and control, evaluate the need for action, determine causes, implement action, review effectiveness, update risks and the management system if needed, and retain documented information as evidence.
Preparing for certification by assuming the audit is a documentation check, so answers describe producing a document set rather than demonstrating implementation, evidence of operation and the audit's two stages.
Candidates revise templates and clause text but have not internalised Stage 1 (readiness, scope, documentation, understanding) versus Stage 2 (effectiveness of implementation), nor the auditor's reliance on records, interviews and sampling.
What to do instead
For each clause, prepare both the requirement and the objective evidence that shows it operates (records, exercise reports, management review minutes, corrective action logs). Be able to explain the purpose and typical content of Stage 1 and Stage 2 and what an auditor would sample for each.